1. Host Discovery

1. Netdiscover

netdiscover -i (network interface name) (example: eth0 or tun0)
netdiscover -i eth0
netdiscover -r ip/24

2. ARP

arp -a 

3. Host Discovery using Nmap

ARP Scan

nmap -sn -PR [Target IP Address] 
# -sn used to disable port scanning

ICMP Echo and ICMP Echo Sweep Scan

nmap -sn -PE [Target IP Address]
nmap -sn -PE [Target Range of IP Addresses]

ICMP Timestamp Ping scan

nmap -sn -PP [Target IP Address]

ICMP Address Mask Scan

nmap -sn -PM [Target IP Address]

TCP Syn Ping Scan

nmap -sn -PS [Target IP Address]

TCP ACK Ping Scan

nmap -sn -PA [Target IP Address]

UDP Ping Scan

nmap -sn -PU [Target IP Address]

4. Host Discovery DC on AD

nmap -p 53,88,135,139,389,445,464,636 -sT -Pn [Target IP Address]

nmap -sn -PS445,389,88,53,135,139,464,636 -sT [Target IP Address]